Skip to content

bug(rootio): Trivy doesn't detect root.io provider when looking in dpkg #9118

@DmitriyLewen

Description

@DmitriyLewen

Description

Trivy uses only Version field to detect root.io packages:

func hasPackageWithPattern(pkgs []ftypes.Package, pattern *regexp.Regexp) bool {
for _, pkg := range pkgs {
if pattern.MatchString(utils.FormatVersion(pkg)) {
return true
}
}
return false
}

But dpkg packages also contain Release and Epoch fields.
root.io suffix is part of Release field, That is why Trivy doesn't detect root.io debian/ubuntu images.

Metadata

Metadata

Assignees

Labels

kind/bugCategorizes issue or PR as related to a bug.

Type

No fields configured for Bug.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions